2003 · Security

The Slammer worm: 376 bytes that slowed the internet in ten minutes

Last reviewed 5 November 2026

On 25 January 2003 the SQL Slammer worm infected about 75,000 servers, most of them within ten minutes, by firing a single 376-byte packet at Microsoft SQL Server. It knocked cash machines offline and slowed the internet worldwide.

What happened

Early on Saturday 25 January 2003, at about 05:30 UTC, a new worm began spreading between computers running Microsoft SQL Server 2000 and its free cut-down version, the Microsoft Desktop Engine (MSDE). Within minutes, network operators saw traffic on UDP port 1434 swamp their links. At 07:11 UTC a post on the Bugtraq security mailing list put it bluntly: “MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!”

The worm became known as SQL Slammer, and also as Sapphire and Helkern. It was the fastest-spreading worm seen up to that time. Researchers from CAIDA and several universities later calculated that the number of infected machines doubled every 8.5 seconds in the first minute, and that it infected about 90% of the vulnerable servers it would ever reach within ten minutes. In total around 75,000 machines were infected.

Why it was so fast

Most worms of the time, such as Code Red two years earlier, had to open a two-way TCP connection to each target before sending their code. Slammer did not. The whole worm was 376 bytes long, small enough to fit in a single UDP packet, and UDP needs no handshake. An infected server simply picked random internet addresses and fired copies of itself at them as fast as its network connection allowed.

That made Slammer’s speed limited by bandwidth rather than by waiting for replies. Within about three minutes the infected machines together were scanning more than 55 million addresses a second. The worm did not write anything to disk and carried no deliberately destructive code. Its damage came almost entirely from the flood of traffic it created.

The flaw it used

Slammer exploited a buffer overflow in the SQL Server Resolution Service, the part of SQL Server that listens on port 1434 to tell clients how to reach database instances. A specially crafted request overflowed a memory buffer and let the attacker’s code run.

The flaw was not new. The British security researcher David Litchfield had found it, reported it to Microsoft and demonstrated proof-of-concept code at the Black Hat Briefings in the summer of 2002. Microsoft published a fix in security bulletin MS02-039 on 24 July 2002, six months before the worm appeared. The worm’s code closely followed Litchfield’s published example.

Many servers had still not been patched, including some of Microsoft’s own. The bug also lived inside MSDE, which was bundled with dozens of other products, so many organisations did not know they were running a vulnerable database at all.

The damage

The traffic overwhelmed routers and links across the internet. In South Korea, internet and mobile data services failed for millions of people for several hours. Bank of America reported that most of its 13,000 cash machines stopped working because the network they relied on was congested. There were reports of airline check-in systems and emergency call centres in the United States slowing or failing that day.

One of the most worrying cases came to light later. Slammer got into the business network of the Davis-Besse nuclear power plant in Ohio through a contractor’s connection that bypassed the firewall, and disabled a safety monitoring display for almost five hours. The plant was already shut down for repairs, so there was no danger, but the US Nuclear Regulatory Commission warned other plants about the risk.

Because Slammer lived only in memory, rebooting an infected server removed it. Blocking UDP port 1434 at network borders stopped it spreading, and most of the internet had recovered by the end of the day.

Why Slammer still matters

Slammer showed that a worm could reach almost every vulnerable machine on the internet before any human had time to respond. Its speed meant that defences had to be in place beforehand, through patching, firewalls that block unnecessary services, and keeping databases off the public internet.

It also showed that patches only work if they are applied. The fix had been available for half a year. Together with Code Red, Nimda and the Blaster worm that followed in August 2003, Slammer pushed Microsoft towards automatic updates and the regular monthly “Patch Tuesday” releases it adopted later in 2003.

Slammer never entirely went away. Unpatched copies of MSDE and SQL Server 2000 kept it circulating on the internet for years afterwards, and security companies still occasionally record bursts of Slammer traffic.